CircleCI security alert: Rotate any secrets stored in CircleCI
1–10 of 87 posts
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#2Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#3Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
Can you elaborate, as someone with little AWS experience? Are OIDC based creds just more scoped? What makes them special?
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#4Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
Can you elaborate, as someone with little AWS experience? Are OIDC based creds just more scoped? What makes them special?
I assume what they meant is having AWS accept short-lived OIDC tokens from Circle's OIDC provider, which in turn would generate them on demand when the CI is actually run. There'd be no secrets at rest and the attack surface would be (in principle) smaller.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#5Perhaps just unfortunate timing, but of note: this comes approximately a month after CircleCI reduced their staff by about 17%[1].
[1]: https://circleci.com/blog/ceo-jim-rose-email-to-circleci-emp...
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#6Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
Can you elaborate, as someone with little AWS experience? Are OIDC based creds just more scoped? What makes them special?
To assume a role with OIDC you'd need to do it from the context of a specific CircleCI job run - getting access to the secrets of a particular CircleCI account alone would not be enough to authenticate to AWS (unlike when you use IAM user credentials).
Even if the attacker had access to env vars from running jobs (which includes the signed token needed to do an OIDC role assumption), those tokens have a short expiry time, and even if an attacker stole that token and performed a role assumption then that session can only be valid for a maximum of 12 hours in AWS, and then you know the attacker is out of your account.
It just significantly reduces, practically nullifies, anything that an attacker can do in your AWS account.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#7Our hodgepodge of microservices- developed over more than a decade- never got coordinated env variables, so now we've got to go through like ~50 services & libraries, one by one, updating secrets. Yuck.
If you do your shit right, you can just dump most of your secrets into some Contexts- containers of env variables- and apply them. Then when this stuff roles around, it's easy to update everything centrally; change the context & everyone sees it. We, alas, can't easily do that, since we have so many differing env var names. New Year, new fun!
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#8Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
I recently did this for one of my GitHub repos which runs several test suites (cumulatively taking >1h). If your actions are slow, pay attention to the IAM role session duration. The maximum duration with role chaining is 1 hour.
In the end your credentials need to outlive your CI/CD actions.
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#9Does this also include deploy SSH keys?
Re: CircleCI security alert: Rotate any secrets stored in CircleCI
#10Great reminder for folks to switch any AWS actions you perform from CI/CD to use OIDC role assumption instead of static IAM user credentials. Then even if an attacker stole all your secrets they can't do anything in your AWS account.
I recently did this for one of my GitHub repos which runs several test suites (cumulatively taking >1h). If your actions are slow, pay attention to the IAM role session duration. The maximum duration with role chaining is 1 hour. In the end your credentials need to outlive your CI/CD actions.
I believe the max duration of an assumed role session is 12 hours, but this can be changed per-role.